ClawHub
Back to skill

Security audit

Product Market Research

Security checks across malware telemetry and agentic risk

Overview

This market-research skill is mostly coherent, but its optional tracking mode would create a persistent cron job without enough scoping or removal guidance.

The one-time research workflow looks reasonable. Before using continuous tracking, require the agent to show the exact schedule, command, sources, output destination, end date, and removal command, and avoid approving a cron job unless you want background recurring searches.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill introduces a persistent cron-based monitoring feature even though the core purpose is one-shot market research. This expands the skill from an on-demand information retrieval tool into a recurring automation capability, which can create unexpected background activity, repeated external requests, and potential privacy or consent issues if enabled without explicit, granular user approval.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.